CVE-2026-2906 Details

A stack-based buffer overflow vulnerability has been identified in the Tenda HG9 router, specifically in the firmware version 300001138. The issue arises within the Samba configuration endpoint '/boaform/formSamba'. When the 'sambaCap' parameter is set to '1', the function processes the 'serverString' parameter from the user request. The vulnerability occurs because the 'sprintf' function is used to write a command string into a local stack buffer that is only 64 bytes long, without proper length validation. This allows for overflow by sending a 'serverString' longer than approximately 40 bytes, overwriting the return address and potentially leading to a denial-of-service condition or remote code execution.

It is recommended to replace the vulnerable 'sprintf' function with 'snprintf' to prevent buffer overflows. Additionally, input validation should be implemented to enforce strict length limits on the 'serverString' parameter before processing it.